Understanding JWT (JSON Web Tokens): Architecture and Claims Standard
JSON Web Tokens (JWT) specified under RFC 7519 provide a compact and self-contained mechanism for securely transmitting information between parties as a JSON object. JWTs are widely implemented in modern single sign-on (SSO) and OAuth 2.0 microservices architectures.
Anatomy of a JSON Web Token
A standard JWT string consists of three distinct sections separated by dot (.) delimiters:
- Header: Specifies the token type (JWT) and the signing algorithm used (e.g., HS256, RS256, or ES256).
- Payload: Contains the claims. Claims are statements about an entity (typically, the authenticated user) and additional metadata.
- Signature: Generated by taking the encoded header, encoded payload, a secret key, and passing them into the specified algorithm to prevent tampering.
Critical Registered Claims in JWT Payloads
iss(Issuer): Identifies the principal that issued the JWT.sub(Subject): Identifies the principal that is the subject of the JWT (e.g., User ID).exp(Expiration Time): Unix epoch timestamp after which the token MUST NOT be accepted.iat(Issued At): Unix epoch timestamp identifying when the token was generated.
Security Warning: Never Expose Tokens on Unknown Web Tools
Public online decoders that transmit tokens back to an external server pose severe security risks, as rogue servers can log authentication bearer tokens to hijack active user sessions. SmartSoft JWT Inspector runs exclusively inside your browser's V8 memory engine. No token data is transmitted over the network.